From 814abc2c9de4276109f1cb5f13ccc64422c324c1 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 13:57:12 -1000
Subject: Check that the auth secret is made safely

The checks replaced get_secret with a constant, so its success path
never ran, and the luaposix stand-in had no link or unlink and a umask
that ignored its argument. Dropping the tightened mask, which leaves
the secret readable by everyone under the usual 022, or accepting a
short secret, passed. The real get_secret now makes the secret in the
run's directory through stand-ins that behave like the calls they
replace, and the checks cover the mask and its restoration, the link
race, the temporary file, reuse and a secret written by hand.
---
 tests/extensions/harness.lua | 33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

(limited to 'tests/extensions/harness.lua')

diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua
index 86f09a6..1a669ff 100644
--- a/tests/extensions/harness.lua
+++ b/tests/extensions/harness.lua
@@ -263,15 +263,42 @@ local function fake_crypt(password, setting)
 	return prefix .. password
 end
 
--- The slices of luaossl and luaposix the auth checks reach.
+-- The slices of luaossl and luaposix the auth checks reach. link refuses a
+-- target that exists, as link(2) does, since that is how a script tells it
+-- lost a race to make a file, and umask hands back the mask it replaces, so
+-- a check can see the old one put back.
 function harness.stub_auth_modules()
 	local rand_counter = 0
+	local mask = 18
 	preload("posix.unistd", {
 		crypt = fake_crypt,
+		link = function(from, to)
+			local existing = io.open(to, "rb")
+			if existing then
+				existing:close()
+				return nil, to .. ": File exists", 17
+			end
+			local source = assert(io.open(from, "rb"))
+			local text = source:read("*a")
+			source:close()
+			local target = assert(io.open(to, "wb"))
+			target:write(text)
+			target:close()
+			return 0
+		end,
+		unlink = function(path)
+			local removed, err = os.remove(path)
+			if not removed then
+				return nil, err, 2
+			end
+			return 0
+		end,
 	})
 	preload("posix.sys.stat", {
-		umask = function()
-			return 18
+		umask = function(new)
+			local old = mask
+			mask = new
+			return old
 		end,
 	})
 	preload("openssl.rand", {
-- 
cgit 2.12.1